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Abstract 

Wc present error-correcting codes that achieve the information-theorcticaUy best possible 
trade-off between the rate and error-correction radius. Specificahy, for every < i? < 1 and 
e > 0, we present an exphcit construction of error-correcting codes of rate R that can be hst 
decoded in polynomial time up to a fraction (1 — i?— e) of worst-case errors. At least theoretically, 
this meets one of the central challenges in algorithmic coding theory. 

Our codes are simple to describe: they are folded Reed-Solomon codes, which are in fact ex- 
actly Reed-Solomon (RS) codes, but viewed as a code over a larger alphabet by careful bundling 
of codeword symbols. Given the ubiquity of RS codes, this is an appealing feature of our result, 
and in fact our methods directly yield better decoding algorithms for RS codes when errors 
occur in phased hursts. 

The alphabet size of these folded RS codes is polynomial in the block length. We are able to 
reduce this to a constant (depending on e) using ideas concerning "list recovery" and expander- 
based codes from [TTl [T^] . Concatenating the folded RS codes with suitable inner codes also 
gives us polynomial time constructible binary codes that can be efficiently list decoded up to 
the Zyablov bound, i.e., up to twice the radius achieved by the standard GMD decoding of 
concatenated codes. 
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1 Introduction 



1.1 Background on List Decoding 

Error-correcting codes enable reliable communication of messages over a noisy channel by cleverly 
introducing redundancy into the message to encode it into a codeword, which is then transmitted 
on the channel. This is accompanied by a decoding procedure that recovers the correct message 
even when several symbols in the transmitted codeword are corrupted. In this work, we focus on 
the adversarial or worst-case model of errors — we do not assume anything about how the errors 
and error locations are distributed beyond an upper bound on the total number of errors that may 
be caused. The central trade-off in this theory is the one between the amount of redundancy needed 
and the fraction of errors that can be corrected. The redundancy is measured by the rate of the 
code, which is the ratio of the the number of information symbols in the message to that in the 
codeword — thus, for a code with encoding function : S'^ — > S"", the rate equals k/n. The block 
length of the code equals n, and S is its alphabet. 

The goal in decoding is to find, given a noisy received word, the actual codeword that it could 
have possibly resulted from. If we target correcting a fraction p of errors (p will be called the error- 
correction radius or decoding radius), then this amounts to finding codewords within (normalized 
Hamming) distance p from the received word. We are guaranteed that there will be a unique such 
codeword provided every two distinct codewords differ on at least a fraction 2p of positions, or in 
other words the relative distance of the code is at least 2p. However, since the relative distance 6 
of a code must satisfy 6 ^ 1 — R where R is the rate of the code (by the Singleton bound), the best 
trade-off between p and R that unique decoding permits is p = pu{R) = (1 ~ -^)/2- But this is 
an overly pessimistic estimate of the error-correction radius, since the way Hamming spheres pack 
in space, for most choices of the received word there will be at most one codeword within distance 
p from it even for p much greater than 5/2. Therefore, always insisting on a unique answer will 
preclude decoding most such received words owing to a few pathological received words that have 
more than one codeword within distance roughly 5/2 from them. 

A notion called list decoding provides a clean way to get around this predicament, and yet deal 
with worst-case error patterns. Under list decoding, the decoder is required to output a list of all 
codewords within distance p from the received word. The notion of list decoding itself is quite old 
and dates back to work in 1950's by Elias [3] and Wozencraft [29]. However, the algorithmic aspects 
of list decoding were not revived until the more recent works [6l [27] which studied the problem for 
complexity-theoretic motivations . 

Let us call a code C {p,L)-list decodable if the number of codewords within distance p of 
any received word is at most L. To obtain better trade-offs via list decoding, we need {p, L)-list 
decodable codes where L is bounded by a polynomial function of the block length, since this is an 
a priori requirement for polynomial time list decoding. How large can p be as a function of R for 
which such (p, L)-list decodable codes exist? A standard random coding argument shows that we 
can have p ^ 1 — R — o(l) over large enough alphabets, cf. [30l [5], and a simple counting argument 
shows that p can be at most 1 — R. Therefore the list decoding capacity, i.e., the information- 
theoretic limit of list decodability, is given by the trade-off Pcap(-R) = 1 — -R = 2pu{R). Thus list 
decoding holds the promise of correcting twice as many errors as unique decoding, for every rate. 

We note that since the original message ^A has Rn symbols, it is information-theoretically 
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impossible to perform the decoding if at most a fraction (R — e) of the received symbols agree with 
the encoding of M (for some e > 0). This holds even for the erasure channel, and even if we are 
told in advance which symbols will be erased! Therefore, for any given rate, list decoding allows 
one to decode up to the largest fraction of errors that one can meaningfully hope to correct. 

The above-mentioned list decodable codes are, however, non-constructive. In order to realize 
the potential of list decoding, one needs explicit constructions of such codes, and on top of that, 
polynomial time algorithms to perform list decoding. After essentially no progress in this direction 
in over 30 years, the work of Sudan [27] and improvements to it in [T7], achieved efficient list 
decoding up to pgs{R) = 1 — errors for an important family of codes called Reed-Solomon 
codes. Note that 1 — VR > Pu{R) = (1 ~ ^)/2 for every rate i?, < i? < 1, so this result showed 
that list decoding can be effectively used to go beyond the unique decoding radius for every rate (see 
Figure [1]). The ratio pQs{R)/ pu{R) approaches 2 for rates i? — > 0, enabling error-correction when 
the fraction of errors approaches 100%, a feature that has found numerous applications outside 
coding theory, see for example [28], [HJ Chap. 12]. 




Figure 1: Error-correction radius p plotted against the rate R of the code for known algorithms. 
The best possible trade-off, i.e., capacity, is p = \ — R, and our work achieves this. 

Unfortunately, the improvement provided by [l^ over unique decoding diminishes for larger 
rates, which is actually the regime of greater practical interest. For rates i? — > 1, the ratio ^p^^j^^ 
approaches 1, and already for rate R = 1/2 the ratio is at most 1.18. Thus, while the results of 
\n\ I17| demonstrated that list decoding always, for every rate, enables correcting more errors than 
unique decoding, they fell short of realizing the full quantitative potential of list decoding. 

The bound pcsiR) stood as the best known error-correction radius for efficient list decoding 
for several years. In fact constructing (p, L)-list decodable codes of rate R ioi p > pcsiR) and 
polynomially bounded L, regardless of the complexity of actually performing list decoding to radius 
p, itself was elusive. Some of this difficulty was due to the fact that 1 — \/S is the largest radius 
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for which smah hst size can be shown generically, via the so-cahed Johnson bound to argue about 
the number of codewords in Hamming balls using only information on the relative distance of the 
code, cf. [7]. 

In a recent breakthrough paper [25] , Parvaresh and Vardy presented codes that are list-decodable 
beyond the 1 — VR radius for low rates R. The codes they suggest are variants of Reed-Solomon 
(RS) codes obtained by evaluating m ^ 1 correlated polynomials at elements of the underlying 
field (with m = 1 giving RS codes). For any m ^ 1, they achieve the error-correction radius 

p[Iy (i?) = 1 — ™^\/m™i?™. For rates i? — > 0, choosing m large enough, they can list decode up to 
radius 1 — 0(i?log(l/i?)), which approaches the capacity 1 — R. However, for R ^ 1/16, the best 
choice of m (the one that maximizes {R)) is in fact m = 1, which reverts back to RS codes and 
the error-correction radius 1 — (See Figure [1] where the bound 1 — \^^4R? for the case m = 2 
is plotted — except for very low rates, it gives a small improvement over pcsiR)-) Thus, getting 
arbitrarily close to capacity for some rate, as well as beating the 1 — ^/R bound for every rate, both 
remained operEI- 



1.2 Our Results 



In this paper, we describe codes that get arbitrarily close to the list decoding capacity Pcap(-R) for 
every rate. In other words, we give explicit codes of rate R together with polynomial time list 
decoding up to a fraction 1 — i? — e of errors for every rate R and arbitrary e > 0. As remarked 
before, this attains the information-theoretically best possible trade-off one can hope for between 
the rate and error-correction radius. While the focus of our presentation is primarily on the major 
asymptotic improvements we obtain over previous methods, we stress that our results offers a 
complexity vs. performance trade-of and gives non-trivial improvements, even for large rates and 
modest block lengths, with a value of the "folding parameter" m as small as 4. A discussion of the 
bounds for small values of m appears in Section 13.41 

Our codes are simple to describe: they are folded Reed-Solomon codes, which are in fact exactly 
Reed-Solomon (RS) codes, but viewed as a code over a larger alphabet by careful bundling of 
codeword symbols. Given the ubiquity of RS codes, this is an appealing feature of our result, and 
in fact our methods directly yield better decoding algorithms for RS codes when errors occur in 
phased bursts (a model considered in |22j). 

Our result extends easily to the problem of list recovery (see Definition 15. ip . The biggest 
advantage here is that we are able to achieve a rate that is independent of the size of the input 
lists. This is an extremely useful feature in concatenated code constructions. We are able to use 
this to reduce the alphabet size needed to achieve capacity, and also obtain results for binary codes. 
We briefly describe these results below. 

To get within e of capacity, the folded RS codes that we construct have alphabet size n'^^^/'^^ 
where n is the block length. By concatenating our codes of rate close to 1 (that are list recoverable) 
with suitable inner codes followed by redistribution of symbols using an expander graph (similar to 
a construction for linear-time unique decodable codes in [12] ) , we can get within e of capacity with 
codes over an alphabet of size 2*^'-^ i°g{i/e)). A counting argument shows that codes that can be 

^Independent of our work, Alex Vardy (personal communication) constructed a variant of the code defined in |25j 
which could be list decoded with fraction of errors more than 1 — for all rates R. However, his construction gives 
only a small improvement over the 1 — \/^ bound and does not achieve the list decoding capacity. 
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list decoded efficiently to within e of the capacity need to have an alphabet size of 2^(V£), so the 
alphabet size we attain is in the same ballpark as the best possible. 

For binary codes, the list decoding capacity is known to be pun{R) = H~^{\ — R) where H{-) 
denotes the binary entropy function [5l [10] . We do not know explicit constructions of binary codes 
that approach this capacity. However, using our codes in a natural concatenation scheme, we give 
polynomial time constructible binary codes of rate R that can be list decoded up to a fraction 
PZyah{R) of crrors, where pzyab(-R) is the "Zyablov bound". See Figure[2]for a plot of these bounds. 




Figure 2: Error-correction radius p of our algorithm for binary codes plotted against the rate R. 
The best possible trade-off, i.e., capacity, is p = — R), and is also plotted. 



1.3 Bibliographic Remarks 

These results were first reported in |14j . We would like to point out that the presentation in this 
paper is somewhat different from the original papers [251 [14] in terms of technical details, organi- 
zation, as well as chronology. With the benefit of hindsight, we believe this alternate presentation 
to be simpler and more self-contained direct than the description in [14], which used the results 
of Parvaresh-Vardy as a black-box. The exact relationship of our codes to the Parvaresh-Vardy 
construction is spelled out in detail in Section [2.31 Below, we discuss some technical aspects of the 
original development of this material, in order to shed light on the origins of our work. We also 
point the reader to the survey [9] for a detailed treatment of recent advances in algorithms for list 
decoding. 

Two independent works by Coppersmith and Sudan [3] and Bleichenbacher, Kiayias and Yung [2] 
considered the variant of RS codes where the message consists of two (or more) independent poly- 
nomials over some field F, and the encoding consists of the joint evaluation of these polynomials at 
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elements of F (so this defines a code over A naive way to decode these codes, which are also 

called "interleaved Reed-Solomon codes," would be to recover the two polynomials individually, by 
running separate instances of the RS decoder. Of course, this gives no gain over the performance of 
RS codes. The hope in these works was that something can possibly be gained by exploiting that 
errors in the two polynomials happen at "synchronized" locations. However, these works could not 
give any improvement over the 1 — ^fR bound known for RS codes for worst-case errors. Never- 
theless, for random errors^ where each error replaces the correct symbol by a uniform random field 
element, they were able to correct well beyond a fraction 1 — of errors. In fact, as the order 
of interleaving (i.e., number of independent polynomials) grows, the radius approaches the optimal 
value \ — R. Since these are large alphabet codes, this model of random errors is not interesting from 
a coding-theoretic perspective, Gthough the algorithms are interesting from an algebraic viewpoint. 

In [23] , Parvaresh and Vardy gave a heuristic decoding algorithm for these interleaved RS codes 
based on multivariate interpolation. However, the provable performance of these codes coincided 
with the 1 — \fR bound for Reed-Solomon codes. The key obstacle in improving this bound was 
the following: for the case when the messages are pairs {f{X),g{X)) of degree k polynomials, two 
algebraically independent relations were needed to identify both f{X) and g{X). The interpolation 
method could only provide one such relation in general (of the form Q(X, f{X), g{X)) = for a 
trivariate polynomial Q{X,Y, Z)). This still left too much ambiguity in the possible values of 
{f{X),g{X)). (The approach in [23] was to find several interpolation polynomials, but there was 
no guarantee that they were not all algebraically dependent.) 

Then, in [25], Parvaresh and Vardy put forth the ingenious idea of obtaining the extra alge- 
braic relation essentially "for free" by enforcing it as an a priori condition satisfied at the encoder. 
Specifically, instead of letting the second polynomial g{X) to be an independent degree k polyno- 
mial, their insight was to make it correlated with f{X) by a specific algebraic condition, such as 
g{X) = f{Xf mod E{X) for some integer d and an irreducible polynomial E{X) of degree k-\-\. 

Then, once we have the interpolation polynomial Q{X,Y^ Z), f{X) can be obtained as follows: 
Reduce the coefficients of Q{X,Y, Z) modulo E[X) to get a polynomial T{Y,Z) with coefficients 
from ¥[X]/{E{X)) and then find roots of the univariate polynomial T{Y,Y'^). This was the key 
idea in [25] to improve the 1 — decoding radius for rates less than 1/16. For rates R ^ 0, their 
decoding radius approached 1 — 0(i?log(l/i?)). 

The modification to using independent polynomials, however, does not come for free. In par- 
ticular, since one sends at least twice as much information as in the original RS code, there is no 
way to construct codes with rate more than 1/2 in the PV scheme. If we use s ^ 2 correlated 
polynomials for the encoding, we incur a factor 1/s loss in the rate. This proves quite expensive, 
and as a result the improvements over RS codes offered by these codes are only manifest at very 
low rates. 

The central idea behind our work is to avoid this rate loss by making the correlated polynomial 
g{X) essentially identical to the first (say g{X) = /(■jX)). Then the evaluations of g{X) can 

^The resulting code is in fact just a Reed-Solomon code where the evaluation points belong to the subfield F of 
the extension field over F of degree two. 

^This is because, as pointed out by Piotr Indyk, over large alphabets one can reduce decoding from uniformly 
random errors to decoding from erasures with a negligible loss in rate. The idea is to pad each codeword symbol 
with a small trail of O's; a uniformly random error is highly unlikely to keep each of these O's intact, and can thus be 
detected and declared as an erasure. Now recall that decoding from a fraction 1 — i? of erasures with rate R is easy 
using Reed-Solomon codes. 
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be inferred as a simple cyclic shift of the evaluations of f{X), so intuitively there is no need to 
explicitly include those too in the encoding. 

1.4 Organization 

We begin with a description of our code construction, folded Reed-Solomon codes, and outline their 
relation to Parvaresh-Vardy codes in Section [2j In Section [3l we present and analyze a trivariate 
interpolation based decoder for folded RS codes, which lets us approach a decoding radius of 
with rate R. In Section U we extend the approach to {s + l)-variate interpolation for any s ^ 3, 
allowing us to decode up to radius 1 — R^/^'^~^^\ and by picking s large enough obtain our main 
result (Theorem 14. 4p on explicit codes achieving list decoding capacity. In Section [U we generalize 
our decoding algorithm to the list recovery setting with almost no loss in rate, and use this powerful 
primitive to reduce the alphabet size of our capacity-achieving codes to a constant depending only 
on distance to capacity as well as to construct binary codes list-decodable up to the Zyablov bound. 
Finally, we close with some remarks in Section [H 

2 Folded Reed-Solomon Codes 

In this section, we will use a simple variant of Reed-Solomon codes called folded Reed-Solomon 
codes for which we can beat the 1 — vT? decoding radius possible for RS codes. In fact, by choosing 
parameters suitably, we can decode close to the optimal fraction 1 — i? of errors with rate R. 

2.1 Description of Folded Codes 

Consider a Reed-Solomon code C = RSf,f* k] consisting of evaluations of degree k polynomials 
over F at the set F* of nonzero elements of F. Let q = \¥\ = n' + 1. Let 7 be a generator of 
the multiplicative group F*, and let the evaluation points be ordered as 1, 7, 7^, . . . , 7" Using 
all nonzero field elements as evaluation points is one of the most commonly used instantiations of 
Reed-Solomon codes. 
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Figure 3: Folding of the Reed Solomon code with parameter m = 4. 



Let m ^ 1 he an integer parameter called the folding parameter. Define n ^ n' to be the 
largest integer that is divisible by m. Let C be the [n, k]^ RS code that is defined by the set of 
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evaluation points 1,7,7^, ... ,7" ^. In other words, C is obtained from C by truncating the last 
n' — n symbols. Note that m divides n. 

Definition 2.1 (Folded Reed-Solomon Code). The m-folded version of the RS code C, denoted 
FRS]f^^^m,fc; is a code of block length N = n/m ot;er F™, where n ^ |F| — 1 is the largest integer that 
is divisible by m. The encoding of a message f{X), a polynomial over¥ of degree at most k, has 
as its j'th symbol, for ^ j < n/m, the m-tuple (/(7-'™'), 7(7-'™''''^), • • • , /(7-'™''''™~^))- In other 
words, the codewords 0/ FRSF,7,m,fc o'^e in one-one correspondence with those of the RS code C and 
are obtained by bundling together consecutive m-tuple of symbols in codewords of C . 

We illustrate the above construction for the choice m = 4 in Figure [3l The polynomial f{X) 
is the message, whose Reed-Solomon encoding consists of the values of / at xq, xi, . . . , Xn-i where 
Xj = 7*. Then, we perform a folding operation by bundling together tuples of 4 symbols to give a 
codeword of length n/4 over the alphabet F^. 

Note that the folding operation does not change the rate R of the original Reed-Solomon code. 
The relative distance of the folded RS code also meets the Singleton bound and is at least 1 — i?. 

Remark 2.1 (Origins of term "folded RS codes"). The terminology of folded RS codes was coined 
in [22] , where an algorithm to correct random errors in such codes was presented (for a noise model 
similar to the one used in [3l [2] that was mentioned earlier). The motivation was to decode RS 
codes from many random "phased burst" errors. Our decoding algorithm for folded RS codes can 
also be likewise viewed as an algorithm to correct beyond the 1 — ^/R bound for RS codes if errors 
occur in large, phased bursts (the actual errors can be adversarial). 

2.2 Why might folding help? 

Since folding seems like such a simplistic operation, and the resulting code is essentially just a RS 
code but viewed as a code over a large alphabet, let us now understand why it can possibly give 
hope to correct more errors compared to the bound for RS codes. 

Consider the folded RS code with folding parameter m = 4. First of all, decoding the folded 
RS code up to a fraction p of errors is certainly not harder than decoding the RS code up to the 
same fraction p of errors. Indeed, we can "unfold" the received word of the folded RS code and 
treat it as a received word of the original RS code and run the RS list decoding algorithm on it. 
The resulting list will certainly include all folded RS codewords within distance p of the received 
word, and it may include some extra codewords which we can, of course, easily prune. 

In fact, decoding the folded RS code is a strictly easier task. It is not too hard to see that 
correcting mT errors, where the errors occur in T contiguous blocks involves far few error patterns 
than correcting mT errors that can be arbitrarily distributed. As a concrete example, say we want 
to correct a fraction 1/4 of errors. Then, if we use the RS code, our decoding algorithm ought to 
be able to correct an error pattern that corrupts every 4'th symbol in the RS encoding of f{X) 
(i.e., corrupts f{x4i) for ^ i < n/4). However, after the folding operation, this error pattern 
corrupts every one of the symbols over the larger alphabet F^, and thus need not be corrected. In 
other words, for the same fraction of errors, the folding operation reduces the total number of error 
patterns that need to be corrected, since the channel has less flexibility in how it may distribute 
the errors. 
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It is of course far from clear how one may exploit this to actually correct more errors. To this 
end, algebraic ideas that exploit the specific nature of the folding and the relationship between a 
polynomial f{X) and its shifted counterpart /(7X) will be used. These will become clear once we 
describe our algorithms later in the paper. 

We note that above "simplification" of the channel is not attained for free since the alphabet 
size increases after the folding operatior0. For folding parameter m that is an absolute constant, 
the increase in alphabet size is moderate and the alphabet remains polynomially large in the 
block length. (Recall that the RS code has an alphabet size that is linear in the block length.) 
Still, having an alphabet size that is a large polynomial is somewhat unsatisfactory. Fortunately, 
existing alphabet reduction techniques, which are used in Section 15.31 can handle polynomially 
large alphabets, so this does not pose a big problem. Moreover, the benefits of our results kick in 
already for very small values of m (see Section 13. 4p . 

2.3 Relation to Parvaresh Vardy codes 

In this subsection, we relate folded RS codes to the Parvaresh- Vardy (PV) codes [25], which among 
other things will help make the ideas presented in the previous subsection more concrete. 

The basic idea in the PV codes is to encode a polynomial / by the evaluations of s ^ 2 
polynomials /o = /, /i, . . . , fs-i where fi{X) = /j_i(X)'^ mod E{X) for an appropriate power d 
(and some irreducible polynomial E{X)) — let us call s the order of such a code. Our first main 
idea is to pick the irreducible polynomial E{X) (and the parameter d) in such a manner that every 
polynomial / of degree at most k satisfies the following identity: f{'yX) = f{X)'^ mod E[X), 
where 7 is the generator of the underlying field. Thus, a folded RS code with bundling using 
an 7 as above is in fact exactly the PV code of order s = m for the set of evaluation points 
{1, 7™, 7^"*, . . . , 7("'/'"~^)'"}. This is nice as it shows that PV codes can meet the Singleton bound 
(since folded RS codes do), but as such does not lead to any better codes for list decoding. 

Here comes our second main idea. Let us compare the folded RS code to a PV code of order 
2 (instead of order m) for the set of evaluation points {1,7,... 7™"^, 7™, . . . , 7""™-, . . . , ^^-2}- We 
find that in the PV encoding of /, for every ^ i ^ n/m — 1 and every < j < m — 1, /(7™'''-') 
appears exactly twice (once as 7(7™^-') and another time as /i(7~^7™^-')), whereas it appears 
only once in the folded RS encoding. (See Figured for an example when m = 4 and s = 2.) In 
other words, the PV and folded RS codes have the same information, but the rate of the folded 
RS codes is bigger by a factor of = 2 — — . Decoding the folded RS codes from a fraction 

p of errors reduces to correcting the same fraction p of errors for the PV code. But the rate vs. 
error-correction radius trade-off is better for the folded RS code since it has (for large enough m, 
almost) twice the rate of the PV code. 

In other words, our folded RS codes are chosen such that they are "compressed" forms of suitable 
PV codes, and thus have better rate than the corresponding PV code for a similar error-correction 
performance. This is where our gain is, and using this idea we are able to construct folded RS 
codes of rate R that are list decodable up to radius roughly 1 — ""a/T?^ for any s ^ I. Picking s 
large enough lets us get within any desired e from capacity. 

^However, we note that most of the operations in decoding still take place in the original field. 



8 





/(•To) 




/(•'Co) 


/(•-'■4) 








/(7.I,,) 




/(t^o) 


/(72^4) 




* 

« - - ^ 








/(7'.i;o) 


/(7'.''^-i) 




1 
1 
\ 






/(t-'.'^^o) 


/(7'.t^-i) 





\ ' « ^ FRS codeword 

% SL i , , , 



/(^■o) 




/(7'X(.) 


/(^^4) 


/(7X4) 


/(7':i-4) 










/(7^4) 


/{7':';4) 







PV codeword 



Figure 4: The correspondence between a folded Reed-Solomon code (with m = A and Xi = 7*) and 
the Parvaresh Vardy code (of order s = 2) evaluated over {1,7,7^,7^, . . . ,7""^, . . . ,7""^}. The 
correspondence for the first block in the folded RS codeword and the first three blocks in the PV 
codeword is shown explicitly in the left corner of the figure. 

3 Trivariate interpolation based decoding 

The list decoding algorithm for RS codes from |27^ [T7] is based on bivariate interpolation. The key 
factor driving the agreement parameter t needed for the decoding to be successful was the ((1, k)- 
weighted) degree D of the interpolated bivariate polynomial. Our quest for an improved algorithm 
for folded RS codes will be based on trying to lower this degree D by using more degrees of 
freedom in the interpolation. Specifically, we will try to use trivariate interpolation of a polynomial 
Q{X, Yi, I2) through n points in F^. This enables performing the interpolation with D = 0{\^k'^n), 
which is much smaller than the Q{^/kn) bound for bivariate interpolation. In principle, this could 
lead to an algorithm that works for agreement fraction R^^^ instead of i?^/^. Of course, this is a 
somewhat simplistic hope and additional ideas are needed to make this approach work. We now 
turn to the task of developing a trivariate interpolation based decoder and proving that it can 
indeed decode up to a fraction 1 — i?^/'^ of errors. 

3.1 Facts about trivariate interpolation 

We begin with some basic definitions and facts concerning trivariate polynomials. 

Definition 3.1. For a polynomial Q{X, Yi, Y2) G F[X, Yi, Y2], its (1, k, k)-weighted degree is defined 
to be the maximum value of £ + kji + kj2 taken over all monomials X^Y^^Y2^ that occur with a 
nonzero coefficient in Q(X,Yi,Y2). 

Definition 3.2 (Multiplicity of zeroes). A polynomial Q(X,Yi,Y2) overF is said to have a zero of 
multiplicity r ^ I at a point (0,^1,^2) G if Q{X + a,Yi+ (3i,Y2 + P2) has no monomial of degree 
less than r with a nonzero coefficient. (The degree of the monomial X^Y^^Y2^ equals i + ji +32-) 
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Lemma 3.1. Let yii, yj2)}"=i be an arbitrary set of hq triples from Let Q{X,Yi,Y2) S 
F[X, Yi,l2] be a nonzero polynomial of {l,k,k)- weighted degree at most D that has a zero of mul- 
tiplicity r at {ai,yii,yi2) for every i, 1 ^ i ^ uq. Let f{X),g{X) be polynomials of degree at 
most k such that for at least t > D/r values of i, we have f{ai) = yn and g{ai) = yi2- Then, 
Q{X,f{X),g{X))^0. 

Proof. If we define R{X) = Q{X, f(X), g{X)), then R{X) is a univariate polynomial of degree at 
most D. Now, for every i for which /(aj) = yn and g{ai) = yi2, {X — oiiY divides R{X) (this follows 
from the definition of what it means for Q to have a zero of multiplicity r at (oj, /(oj), 
Therefore if rt > D, then R{X) has more roots (counting multiplicities) than its degree, and so it 
must be the zero polynomial. □ 

Lemma 3.2. Given an arbitrary set of uq triples {{ai,yii,yi2)}^=i from F"^ and an integer param- 
eter r ^ 1, there exists a nonzero polynomial Q{X,Yi,Y2) over F of {l,k,k) -weighted degree at 
most D such that Q{X,Yi,Y2) has a zero of multiplicity r at {ai,yii,yi2) for all i £ {1,2 .. . ,no}, 
provided 

Moreover, we can find such a Q{X,Yi,Y2) in time polynomial in nQ,r by solving a system of 
homogeneous linear equations over ¥. 

Proof. The condition that Q{X,Yi,Y2) has a zero of multiplicity r at a point amounts to (^^^) 
homogeneous linear conditions in the coefficients of Q. The number of monomials in Q{X,Yi,Y2) 
equals the number, say A^3(fc, D), of triples {i, 31,32) of nonnegative integers that obey i+kji+kj2 ^ 
D. One can show that the number N3(k, D) is at least as large as the volume of the 3-dimensional 
region {x + kyi + ky2 ^ D \ x,yi,y2 ^ 0} C [25]. An easy calculation shows that the latter 
volume equals |p. Hence, if ^ > 720(^3^), then the number of unknowns exceeds the number of 
equations, and we are guaranteed a nonzero solution. (See Remark 13. II for an accurate estimate of 
the number of monomials of (1, k, A;)-weighted degree at most D, which sometimes leads to a better 
condition under which a polynomial Q with the stated property exists.) □ 

3.2 Using trivariate interpolation for Folded RS codes 

Let us now see how trivariate interpolation can be used in the context of decoding the folded RS 
code C" = FRSf 

"/,m,k of block length A'^ — n/m. (Throughout this section, we will use n to denote 
the block length of the "unfolded" RS code.) Given a received word z G (F™)^ for C" that needs 
to be list decoded, we define y G F" to be the corresponding "unfolded" received word. (Formally, 
let the j'th symbol of z be {zjfl, . . . , Zj^m—i) for ^ j < N . Then y is defined by yjm+i = -Zj,; for 
{) ^3 < N and ^ I < m.) Finally define / to be the set {0, 1,2,... , n-l}\{m-l, 2m-l, . . . ,n-l] 
and let no = |/|. Note that no = (m, — l)n/m. 

Suppose f{X) is a polynomial whose encoding agrees with z on at least t locations. Then, here 
is an obvious but important observation: 

For at least t{m — 1) values of i, i G /, both the equalities /(7*) = yi and /(7*'''^) = yi+i 
hold. 
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Define the notation g{X) = f{'yX). Therefore, if we consider the uq triples {Y,yi,yi+i) £ for 
i & I, then for at least t{m — 1) triples, we have /(7*) = yi and 5(7*) = yi+i- This suggests that 
interpolating a polynomial Q{X, Yi, Y2) through these no triples and employing Lemma [3. H we can 
hope that f{X) will satisfy Q{X, f{X), /(7X)) = 0, and then somehow use this to find f{X). We 
formalize this in the following lemma. The proof follows immediately from the preceding discussion 
and Lemma l3.ll 

Lemma 3.3. Let z G (F"^)^ and let y ^ ¥^ be the unfolded version of z. Let Q{X,Yi,Y2) be 
any nonzero polynomial over ¥ of {1, k, k)- weighted degree at D that has a zero of multiplicity 
r at (7*,yi,yi+i) for i G L. Let t be an integer such that t > ^^^j^y . Then every polynomial 
f{X) G ¥[X] of degree at most k whose encoding according to FRSF,7,m,fc agrees with z on at least 
t locations satisfies Q{X, f{X), f{'yX)) = 0. 

Lemmas 13.21 and 13.31 motivate the following approach to list decoding the folded RS code 
FRSF,7,m,fc- Here z G (F™")^ is the received word and y = {yo,yi, . . . ,yn-i) G IF" is its unfolded 
version. The algorithm uses an integer multiplicity parameter r ^ 1, and is intended to work for 
an agreement parameter 1 ^ t ^ N . 

Algorithm Trivariate-FRS-decoder: 

Step 1 (Trivariate Interpolation) Define the degree parameter 



D= [^k'^nor{r + l){r + 2)\ +1 . (2) 

Interpolate a nonzero polynomial Q{X, Yi,Y2) with coefficients from F with the following two 
properties: (i) Q has (1, k, A;)-weighted degree at most D, and (ii) Q has a zero of multiplicity 
r at (7*,yi,yj+i) for i £ L. (Lemma 13.21 guarantees the feasibility of this step as well as its 
computability in time polynomial in r and no (and hence, n).) 

Step 2 (Ti'ivariate "Root-finding") Find a list of all degree ^ k polynomials f{X) G ¥[X] such that 
Q{X, f{X), /(7X)) = 0. Output those whose encoding agrees with z on at least t locations. 

Ignoring the time complexity of Step 2 for now, we can already claim the following result 
concerning the error-correction performance of this strategy. 



Theorem 3.4. The algorithm Trivariate-FRS-decoder successfully list decodes the folded Reed- 
Solomon code FRSp^^^m,*: W to a number of errors equal to N 



Proof. By Lemma [3.3l we know that any f{X) whose encoding agrees with z on t or more locations 
will be output in Step 2, provided t > j^^^zfyi'.- For the choice of D in ([2]), this condition is met for 

the choice t = 1+ L^ (^!_7)3 (l + 7) (l + f) + {^,n-i)r \ ■ number of errors is equal to TV - t, 
and recalling that n = mN and no = {m — l)n/m, we get the claimed bound on the list decoding 
radius. □ 

The rate of the folded Reed-Solomon code is i? = {k + l)/n > k/n, and so the fraction of errors 
corrected (for large enough r) is 1— ( j . Note that for m = 2, this is just the bound 1 — (2i?)^/^ 
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that Parvaresh-Vardy obtained for decoding their codes using trivariate interpolation |25| . The 
bound becomes better for larger values of m, and letting the folding parameter m grow, we can 
approach a decoding radius of 1 — R^^^. 

3.3 Root-finding step 

In light of the above discussion in Section [3.21 the only missing piece in our decoding algorithm is 
an efficient way to solve the following trivariate "root-finding" type problem: 

Given a nonzero polynomial Q{X, Yi, Y2) with coefficients from a finite field F of size g, 
a primitive element 7 of the field F, and an integer parameter k < q — 1, find a list of 
all polynomials f{X) of degree at most k such that Q{X, f{X), /(7X)) = 0. 

The following simple algebraic lemma is at the heart of our solution to this problem. 

Lemma 3.5. Let F be the field Fg of size q, and let 7 &e a primitive element that generates its 
multiplicative group. Then we have the following two facts: 

1. The polynomial E{X) X"?"^ — ^ is irreducible over F. 

2. Every polynomial f{X) G ¥[X] of degree less than q—1 satisfies f{'yX) = f{Xy mod E{X). 

Proof. The fact that E{X) = X'^"^ — 7 is irreducible over Fg follows from a known, precise char- 
acterization of all irreducible binomials, i.e., polynomials of the form X"" — c, see for instance |23t 
Chap. 3, Sec. 5]. For completeness, and since this is an easy special case, we now prove this 
fact. Suppose E{X) is not irreducible and some irreducible polynomial f{X) S ¥[X] of degree 
b, 1 ^ b < q — 1, divides it. Let <^ be a root of f{X) in the extension field F^t. We then have 

^'^ ~^ = 1. Also, /(C) = implies C?"^ = 7. These equations together imply 7 9-1 = 1. Now, 7 is 
primitive in ¥q, so that 7"^ = 1 iff m is divisible by {q — 1). We conclude that q — I must divide 
1 + q + q"^ + ■ ■ ■ + q^~^. This is, however, impossible since 1 + q + q^ + ■ ■ ■ + q^~^ = b (mod {q — 1)) 
and < b < q — 1. This contradiction proves that E(X) has no such factor of degree less than 
q — 1, and is therefore irreducible. 

For the second part, we have the simple but useful identity f{XY = f{X'^) that holds for all 
polynomials in Fg[X]. Therefore, f{XY — /(7X) = f{X'=') — /(7X). The latter polynomial is 
clearly divisible by X^ - 7X, and thus also by X'^-^ - 7. Hence /(X)« = f{jX) (mod E{X)) 
which implies that f{XY mod E{X) = f{"fX) since the degree of /(7X) is less than ^ — 1. □ 

Armed with this lemma, we are ready to tackle the trivariate root-finding problem. 

Theorem 3.6. There is a deterministic algorithm that on input a finite field ¥ of size q, a primitive 
element 7 of the field F, a nonzero polynomial Q{X,Yi,Y2) G F[X, Yi,y2] of degree less than q in 
Y\, and an integer parameter k < q — 1, outputs a list of all polynomials f{X) of degree at most k 
satisfying the condition Q{X, f{X), f('yX)) = 0. The algorithm has runtime polynomial in q. 

Proof. Let E{X) = X'^~^ —7. We know by Lemma [3. 5 1 that E{X) is irreducible. We first divide out 
the largest power of E{X) that divides Q{X,Yi,Y2) to obtain Qo{X,Yi,Y2) where Q{X,Yi,Y2) = 
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E{XfQo{X,Yi,Y2) for some 6 ^ and E{X) does not divide Qo{X,Yi,Y2). Clearly, if f{X) 
satisfies Q{X, f{X), f{jX)) = 0, then Qo{XJ{X),f{jX)) = as well, so we will work with 
Qo instead of Q. Let us view Qo{X,Yi,Y2) as a polynomial Tq(Yi,Y2) with coefficients from ¥[X]. 
Further, reduce each of the coefficients modulo E{X) to get a polynomial T(yi, 12) with coefficients 

from the extension field F = F[X]/{E{X)) (this is a field since E(X) is irreducible over F). We 
note that T{Yi,Y2) is a nonzero polynomial since Qo{X,Yi,Y2) is not divisible by E{X). 

In view of Lemma l3.5l it suffices to find degree ^ k polynomials f{X) satisfying Qo{X, f{X), f{Xy) 
(mod E{X)) = 0. In turn, this means it suffices to find elements F G F satisfying r(F, F^) = 0. If 

we define the univariate polynomial R{Yi) '= T(Yi, Y^), this is equivalent to finding all F S F such 
that i?(F) = 0, or in other words the roots in F of R{Yi). 

Now R{Yi) is a nonzero polynomial since -^(^1) = iff I2 — Yi divides T{Yi,Y2), and this 
cannot happen as T{Yi, Y2) has degree less than less than qinYi. The degree of R(Yi) is at most 
dq where d is the total degree of Q{X, Yi, 12)- The characteristic of F is at most q, and its degree 
over the base field is at most qlgq. Therefore, we can find all roots of R{Yi) by a deterministic 
algorithm running in time polynomial in d,q [1]. Each of the roots will be a polynomial in ¥[X] of 
degree less than q — 1. Once we find all the roots, we prune the list and only output those roots of 
f{X) that have degree at most k and satisfy Qo{X, f{X), f{-yX)) =0. □ 

With this, we have a polynomial time implementation of the algorithm Trivariate-FRS-decoder. 
There is the technicality that the degree of Q{X,Yi,Y2) in Yi should be less than q. This degree 
is at most D/k, which by the choice of D in ([2]) is at most (r + 3) y^n/k < (r + 3)q^^^. For a fixed 
r and growing q, the degree is much smaller than q. (In fact, for constant rate codes, the degree is 
a constant independent of n.) By letting m, r grow in Theorem 13.41 and recalling that the running 
time is polynomial in n, r, we can conclude the following main result of this section. 

Theorem 3.7. For every e > and R, < R < I, there is a family of m-folded Reed-Solomon 
codes for m = 0{l/e) that have rate at least R and which can be list decoded up to a fraction 
1 — (1 + e)R^/^ of errors in time polynomial in the block length and 1/e. 

3.4 Alternate decoding bound for high rates and practical considerations 

In the discussion above, the fraction of errors 

1 - (^) , can it p^r'^\R), approaches 1 - i?2/3 

(and hence improves upon the bound of pQs{R) = 1 ~ in [T7]) for every rate R for large enough 
m. For practical implementations the parameter m will be some small fixed integer. Note that for 
fixed m, the bound of pi^''^\R) is useless for 72 ^ 1 — ^, whereas the 1 — \/R bound for decoding 
Reed-Solomon codes |17] is meaningful for all i? < 1. 

Given that one is often interested in high rate codes, this suggests that in order to reap the 
benefits of our new codes for large rates, the folding parameter needs to be picked large enough. 
Fortunately, this is not the case, and we now show that one can beat the 1 — ^/R bound for all 
rates R for a fixed value of the folding parameter m; in fact, a value as small as m = 5 suffices. 
These bounds also hint at the fact that the improvements offered by the decoding algorithms in 
this paper are not just asymptotic and kick in for parameter choices that could be practical. 

Our goal now is to sketch how a minor change to the algorithm in Section 13.21 allows us to 
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correct a fraction 

of errors. The bound of p'^''^\R) gives a larger decoding radius than p^''^\r) for large rates 

R. A more precise comparison of the bounds p^''^\ p^''^^ and pes is done at the end of this 

subsection. The improvement of the decoding radius to p^''^'^ (R) for large rates (and hence small 
error fractions) comes via another way to analyze (a variant of) the algorithm in Section [3.21 which 
was suggested to us by J0rn Justesen. The algorithm is the same as in Section [3.21 except that the 
set of interpolating points is slightly different. In particular in the trivariate interpolating step, we 
choose / = {0, 1, . . . , n — 2}. Let no = |/| = n — 1. The crucial observation here is that an erroneous 
symbol Zj S F™ (for some position ^ j < in the received word z) translates to at most m + 1 
errors among the interpolation tuples in the trivariate interpolation step. More precisely, given 
that ^ e ^ A^ is the number of errors. 

For at least t' = tlq — e{m + 1) values of i, i G /, both the equalities /(7*) = yi and 

/(y+i) = vi+i hold. 

By Lemmas 13 . 1 1 13 . 2l and the degree bound ([2]), the algorithm outlined above will work as long as 



no - e(?n + 1) > llk^no ( 1 + - ) ( 1 + - ) + -. 



Recalling that no = n — 1 < n, the above is satisfied if 




Recalling that n = Nm, the above is satisfied if 



e < 




m + 1 



Noting that m ^ 1 , leads to the following analog of Theorem [37 

Theorem 3.8. The version of algorithm Trivariate-FRS-decoder discussed above, successfully list 
decodes the folded Reed-Solomon code FRSF,7,m,fc o,s long as the number of errors is less than 



m+l 



N 1 



1. 



For large enough r, the above implies that rate R folded RS codes can be list decoded up to a 

^(m,2) " " 

m+l 



fraction p^' \ii) = i^^j (l - i^^/S) of errors. 
Comparison of the bounds 

We now make a comparison between the bounds p^''^\ Pa"'^^ and pcs- We first note that 

/ \ 3/2 

P^''^ (R) ^ Pi"'^ {R) for every rate R^[l-^) ■ Particular, p^'"'' {R) > 
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/9a ' (R) for all rates 1 ~ ^- Let us now compare p\!^' (R) and pGs{R)- Specifically, we give 
a heuristic argument to show that for high enough rates R and m ^ 4, p^'^\r) > pQs{R)- Let 
R = 1 — e. Then ignoring the O(e^) terms in the Taylor expansions we get pGs(l — s) ~ e/2 and 
^(jn,,2)^^ _ ii^Q latter quantity is strictly larger than the former for every m ^ 4. In 

fact, it can be verified that for all rates R ^ 0.44, > pes- Figure [5] plots the tradeoff pGs(-R) 

and max (^p^'^\r), p^''^\r)^ for some small values of m ^ 2. The limit for large m, which is 
1 — i?^/^, is also plotted. 





R (RATE) 



Figure 5: Error-correction radius max(p[j™' (R), p^' (R)) for m = 4,5. For comparison pQs{R) = 
1 — and the limit 1 — R^^'^ are also plotted. For m = 5, the performance of the trivariate 
interpolation algorithm strictly improves upon that of pcs for all rates. 



Remark 3.1 (Better bound on (1, fc, fc)-weighted degree). For small values of the parameter r, 
one should use a better estimate for the degree bound D than the bound ([T]) based on the volume 
argument. The number of monomials X^Y^^Y2^ whose (1, /c, A;)-weighted degree is at most D is 
exactly equal to 



where a = [-^J . This is often larger than the ^ lower bound we used in Lemma [3T2l and certainly 
for any specific setting of parameters n, k, r, the estimate should be used. A similar remark 
applies for the bound used in Lemma 14.11 for (s + l)-variate interpolation. Since it makes no 
difference for the asymptotics, we chose to stick with the simpler expressions. 
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4 Codes approaching list decoding capacity 



Given that trivariate interpolation improved the decoding radius achievable with rate R from 

1 _ 1 _ ^2/3 

it is natural to attempt to use higher order interpolation to improve the 
decoding radius further. In this section, we discuss the (quite straightforward) technical changes 
needed for such a generalization. 

Consider again the m- folded RS code C = FRSf^^^^./c where F = Fg. Let s be an integer in 
the range 1 ^ s ^ m. We will develop a decoding algorithm based on interpolating an {s + 1)- 
variate polynomial Q{X, Yi, Y2, . . . , Ys)- The definitions of the (1, k,k, . . . , fc)-weighted degree (with 
k repeated s times) of Q and the multiplicity at a point {a, (32, ■ ■ ■ , Ps) G F*'^^ are straightforward 
extensions of Definitions 13.11 and 13.21 

As before let y = {yo,yi, . . . ,yn-i) be the unfolded version of the received word z G (F™-)^ of 
the folded RS code that needs to be decoded. Define the set of interpolations points to be 

(n/m— 1 
{jm + m — s + l,jm + m — s + 2, . . . ,jm + m — 1} 
j=0 

The reason for this choice of / is that if the m-tuple containing yi is correct and i € I, then all the 
s values yi, yi+i, yi+s~i are correct. 

Define no = |/|. Note that no = n{m — s + l)/m. Following algorithm Trivariate-FRS-decoder, 
for suitable integer parameters D,r, the interpolation phase of the {s + l)-variate FRS decoder will 
fit a nonzero polynomial Q{X, Yi, . . . , Ys) with the following properties: 

1. It has (1, k,k, . . . , /!;)-weighted degree at most D 

2. It has a zero of multiplicity r at (7*, yi, yi+i, ■ ■ ■ , yi-^s-i) for i £ I- 
The following is a straightforward generalization of Lemmas 13.21 and 13. 3[ 

Lemma 4.1. 1. Provided (^J^^^f^s > ''^0(5^1); O' nonzero polynomial Q{X,Yi, . . . ,Ys) with the 
above stated properties exists and moreover can be found in time polynomial in n and . 

2. Let t be an integer such that t > ^^J^^iy ■ Then every polynomial f{X) G ¥[X\ of degree at 
most k whose encoding according to FRSp^^^m,*: agrees with the received word z on at least t 
locations satisfies Q{X, f{X), f{jX), fi^-^X)) = 0. 

Proof. The first part follows from (i) a simple lower bound on the number of monomials X^'Y^^ • • • Y^" 
with a + k{bi + b2 + ■ ■ ■ + bg) ^ D , which gives the number of coefficients of Q{X, Yi, . . . , Yg), and 
(ii) an estimation of the number of (s + l)-variate monomials of total degree less than r, which 
gives the number of interpolation conditions per (s + l)-tuple. 

The second part is similar to the proof of Lemma 13.31 If f{X) has agreement on at least 
t locations of z, then for at least t{m — s + 1) of the (s + l)-tuples (7*, y^, yj+i, . . . , yj+s_i), we 

have /(7*''~-') = yi+j for j = 0, l,...,s — 1. As in Lemma |3.H we conclude that R{X) =^ 
Q{X, f{X), f{'yX), . . . ,f{'y^~^X)) has a zero of multiplicity r at 7* for each such (s + l)-tuple. 
Also, by design R{X) has degree at most D. Hence if t{m — s + l)r > D, then R{X) has more 
zeroes (counting multiplicities) than its degree, and thus R{X) = 0. □ 
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Note the lower bound condition on D above is met with the choice 



D 



{k'nor{r + 1) • • • (r + s))^/("+^) + 1 . (5) 



The task of finding a hst of ah degree k polynomials f{X) G ¥[X] satisfying 
Q{X, f{X), fi^jX), . . . , f{'-/^~^X)) = can be solved using ideas similar to the proof of Theo- 
rem 13.61 First, by dividing out by E{X) enough times, we can assume that not all coefficients 
of Q{X, Yi, . . . ,Ys), viewed as a polynomial in Yi, . . . ,Ys with coefficients in F[X], are divisible 
by E(X). We can then go modulo E{X) to get a nonzero polynomial T{Yi,Y2, . . . ,Ys) over the 
extension field F = ¥[X]/{E{X)). Now, by Lemma [331 we have f{-/^X) = f{X)i' mod E{X) for 
every j ^ 1. Therefore, the task at hand reduces to the problem of finding all roots F G F of the 

3 — 1 

polynomial R{Yi) where R{Yi) = T(Yi,Y^ , . . . ,Y^ ). There is the risk that -^(^1) is the zero 
polynomial, but it is easily seen that this cannot happen if the total degree of T is less than q. This 
will be the case since the total degree is at most D/k, which is at most (r + s)(n/k)^^^^^^^ <^ q. 

The degree of the polynomial R{Yi) is at most (7*, and therefore all its roots in F can be found 
in time. We conclude that the "root-finding" step can be accomplished in polynomial time. 

The algorithm works for agreement t > (^J^j^-^y , which for the choice of -D in ([5]) is satisfied if 





in 

m — s + 1 \ 

V=i 

The above along with the fact that tiq = N{m — s -|- 1) implies the following, which is multivariate 
generalization of Theorem 13.41 

Theorem 4.2. For every integer m ^ 1 and every s, 1 ^ s ^ m, the (s + l)-variate FRS decoder 
successfully list decodes the m-folded Reed-Solomon code FRSp^^^m.fc W to a radius N — t as long as 
the agreement parameter t satisfies 



t > =+J 



m — s + 1 I \ r 



The algorithm runs in n^^^^ time and outputs a list of size at most \F\^ = n^^^\ 

Recalling that the block length of FRSiF^^^m,fc is = n/m and the rate is (A; + l)/n, the above 
algorithm can decode a fraction of errors approaching 



1 



s+l 



niR \ ^ YJ f j 



m — s + 1 I \ r 



n p) 



using lists of size at most g*. By picking r, m large enough compared to s, the decoding radius can 
be made larger than 1 — (1 -|- 5)R^^^^'^^'^ for any desired (5 > 0. We state this result formally below. 

Theorem 4.3. For every Q < 5 ^ 1, integer s ^ 1 and < R < 1, there is a family of m-folded 
Reed-Solomon codes for m = 0{s/5) that have rate at least R and which can he list decoded up to a 
fraction !-{! + 5)R''/^'+'^^ of errors in time (Nm)'^^^') and outputs a list of size at most (Nm)'-^^'^^ 
where N is the block length of the code. The alphabet size of the code as a function of the block 
length N is (iVm)<^(™). 
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Proof. We first note that ([7]) is at least 



1- 1 + -^^ (8) 



We now instantiate the parameters r and m in terms of s and 5: 

3s (s-l)(3 + 5) 
r = — m = . 



With the above choice, we have 



■s\ m I ^ Q 



1 + - -T= 1 + ^ <l + 5. 

Together with the bound dH) on the decoding radius, we conclude that the (s + l)-variate decoding 
algorithm certainly list decodes up to a fraction 1 — (1 + b)Bfl^^'^'^^ of errors. 

The worst case list size is and the claim on the list size follows by recalling that q ^ n+m and 
N = n/m. The alphabet size is q"^ = {Nm)^^^\ The running time has two major components: 
(1) Interpolating the s + 1-variate polynomial Q{-), which by Lemma 14.11 is (nr*)*-^^^); and (2) 
Finding all the roots of the interpolated polynomial, which takes time. Of the two, the time 
complexity of the root finding step dominates, which is {Nm)^^'^\ □ 

In the limit of large s, the decoding radius approaches the list decoding capacity 1 — R, leading 
to our main result. 

Theorem 4.4 (Explicit capacity-approaching codes). For every e > and < R < 1, there is a 
family of folded Reed-Solomon codes that have rate at least R and which can be list decoded up to a 
fraction 1 — R — e of errors in time (and outputs a list of size at most) [N/e^)^^^ iog(i/-R)) where 
N is the block length of the code. The alphabet size of the code as a function of the block length N 
is {N/e^fW^'l 



and 6='4^- (9) 



Proof. Given e, i?, we will apply Theorem 14.31 with the choice 

" log(l/^) 
log(l + e] 

The list decoding radius guaranteed by Theorem 14.31 is at least 

1 - (1 + = l-i?(l + 5)(l/i2)i/("+^) 

^ I - R{1 + 5){l + e) (by the choice of s in Q) 
= \ — {R + e) (using the value of 5) . 

We now turn our attention to the time complexity of the decoding algorithm and the alphabet 
size of the code. To this end we first claim that m = 0(l/e^). To see this note that by the definition 
of s and 5: 

^\ ^f. ^(l + e)^ ^ 1 -Rln(l/i?)^^ /.2x 



where for the last step we used ln(l/i?) ^ — 1 for < R ^ 1. The claims on the running time, 
worst case list size and the alphabet size of the code follow from Theorem 14.31 and the facts that 
m = 0{l/e^) &nds = 0{e-Hog{l/R)). □ 
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With the proof of our main theoretical result (Theorem 14. 4p completed, we close this section 
with a few remarks. 



Remark 4.1 (Improvement to decoding radius for high rates). As in Section [3.41 it is possible to 
improve the bound of ([7]) to 





m 


( 

\ — s+1 


max 


i m + s — 1 








The former bound is better for large rates. 

Remark 4.2 (Optimality of degree q of relation between /(X) and /{-jX)). Let K be the extension 
field ¥q[X]/{E{X)) where E{X) = X'^~^ — 7. The elements of K are in one-one correspondence 
with polynomials of degree less than q — 1 over F^. The content of Lemma 13.51 which we made 
crucial use of above, is that the map T : K ^ K defined by f{X) 1— > /(7X) is a degree q map over 
K, i.e., as a polynomial over K, T{Z) = Z'^. The fact that this degree is as large as q is in turn the 
cause for the large list size that we need for list decoding. It is natural to ask if a different map V 
could have lower degree (perhaps over a different extension field K\). Unfortunately, it turns out 
this is not possible, as argued below. 

Indeed, let F' be a ring homomorphism of defined by r'(/(X)) = /(G(X)) for some 

polynomial G over Fg. Let E\{X') be an irreducible polynomial over Fg of degree ^, and let K\ = 
¥q[X]/{Ei{X)) be the associated extension field. We can view T' as a map Fi on Ki by identifying 
polynomials of degree less than £ with Ki and defining Ti(f(X)) = f{G{X)) mod E\{X). The key 
point is that Fi is an ¥q-linear map on Ki. Expressed as a polynomial over Ki, Fi must therefore 
be a linearized polynomial, [231 Chap. 3, Sec. 4], which has only terms with exponents that are 
powers of q (including q^ = 1). It turns out that for our purposes Fi cannot have degree 1, and so 
it must have degree at least q. 



5 Extensions and Codes over Smaller Alphabets 
5.1 Extension to list recovery 

We now present a very useful generalization of the list decoding result of Theorem 14.41 to the 
setting of list recovery. Under the list recovery problem, one is given as input for each codeword 
position, not just one but a set of several, say I, alphabet symbols. The goal is to find and output 
all codewords which agree with some element of the input sets for several positions. Codes for 
which this more general problem can be solved turn out to be extremely valuable as outer codes in 
concatenated code constructions. In short, this is because one can pass a set of possibilities from 
decodings of the inner codes and then list recover the outer code with those sets as the input. If 
we only had a list-decodable code at the outer level, we will be forced to make a unique choice in 
decoding the inner codes thus losing valuable information. 

Definition 5.1 (List Recovery). A code C C S" is said to be {(,1, L)-list recoverable if for every 
sequence of sets Si,... ,Sn where each 5j C S has at most I elements, the number of codewords 
c £ C for which ci G Si for at least Qn positions i £ {1,2, ... ,n} is at most L. 
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A code C C is said to {C,l)-list recoverable in polynomial time if it is {(,1, L{n))-list re- 
coverable for some polynomially bounded function L{-), and moreover there is a polynomial time 
algorithm to find the at most L{n) codewords that are solutions to any {(^,1, L{n))-list recovery 
instance. 

We remark that when I = 1, 1, •)-hst recovery is the same as hst decoding up to a (1 — C) 
fraction of errors. List recovery has been imphcitly studied in several works; the name itself was 
coined in |llj . 

Theorem 14.41 can be generahzed to hst recover the folded RS codes. Specifically, for a FRS 
code with parameters as in Section for an arbitrary constant / ^ 1, we can Z)-list recover in 
polynomial time provided 



' ^■"'fl('i + f)+2. (10) 



m — s + 1 / m 



where N = n/m. We briefly justify this claim. The generalization of the list decoding algorithm of 
Section d] is straightforward: instead of one interpolation condition for each symbol of the received 
word, we just impose \Si\ ^ / many interpolation conditions for each position i G {1, 2, . . . , n} (where 
Si is the i'th input set in the list recovery instance). The number of interpolation conditions is at 
most nl, and so replacing n by nl in the bound of Lemma HTTl guarantees successful decoding. This 
in turn implies that the condition on the number of agreement of ^ generalizes to the one in (|1U|) . 
This straightforward generalization to list recovery is a positive feature of all interpolation based 
decoding algorithms [271 El E5] beginning with the one due to Sudan 



Picking r ^ s and m ^ s in ()10p . we get (C,0"list recover with rate R for ^ ^ (^IR'^)^^^^^^\ 
Now comes the remarkable fact: we can pick a suitable s ^ I and perform {(, Z)-list recovery 
with agreement parameter ^ ^ R-\- e which is independent of /! We state the formal result below 
(Theorem 14.41 is a special case when / = 1). 

Theorem 5.1. For every integer / ^ 1, for all R, < R < 1 and e > 0, and for every prime 
p, there is an explicit family of folded Reed-Solomon codes over fields of characteristic p that have 
rate at least R and which can be {R-\- e,l)-list recovered in polynomial time. The alphabet size of a 
code of block length N in the family is (Ar/e2)0{e-2 log . 

Proof. (Sketch) Using the exact same arguments as in the proof of Theorem 14.31 to the agree- 
ment condition of (jlOp . we get that one can list recover in polynomial time as long as C ^ 
(1 + 6){lR^y^^'^'^^\ for any 6 > 0. The arguments to obtains a lower bound of + e are simi- 
lar to the ones employed in the proof of theorem 14. 4[ However, s needs to be defined in a slightly 
different manner: 

' log(V^) 
log(l + e) 

Also this implies that m = O [ 2 ) > which implies the claimed bound on the alphabet size of 



the code. □ 

Remark 5.1 (Soft Decoding). The decoding algorithm for folded RS codes from Theorem 14.41 can 
be further generalized to handle soft information, where for each codeword position i the decoder 
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is given as input a non-negative weight Wi^z for each possible alphabet symbol z. The weights Wi^z 
can be used to encode the confidence information concerning the hkehhood of the the i'th symbol 
of the codeword being z [21]. For any e > 0, for suitable choice of parameters, our codes of rate 
R over alphabet S have a soft decoding algorithm that outputs all codewords c = (ci, C2, . . . , cat) 
that satisfy 



For s = 1, this soft decoding condition is identical to the one for Reed-Solomon codes in [T7] . 
5.2 Binary codes decodable up to Zyablov bound 

Concatenating the folded RS codes with suitable inner codes also gives us polytime constructible 
binary codes that can be efficiently list decoded up to the Zyablov bound, i.e., up to twice the radius 
achieved by the standard GMD decoding of concatenated codes. The optimal list recoverability of 
the folded RS codes plays a crucial role in establishing such a result. 

Theorem 5.2. For all < R,r < 1 and all e > 0, there is a polynomial time constructible family 
of binary linear codes of rate at least R ■ r which can be list decoded in polynomial time up to a 
fraction (1 — R)H~^{1 — r) — e of errors. 

Proof. We will construct binary codes with the claimed property by concatenating two codes Ci 
and C2. For Ci, we will use a folded RS code over a field of characteristic 2 with block length ni, 
rate at least R, and which can be {R + e, /)-list recovered in polynomial time for I = [10/e]. Let 
the alphabet size of Ci be 2*^ where M = 0{e'^ log{l/e)logni). For C2, we will use a binary 
linear code of dimension M and rate at least r which is (p, i)-list decodable for p = H~^(l — r — e). 
Such a code is known to exist via a random coding argument that employs the semi-random 
method [10]. Also, a greedy construction of such a code by constructing its M basis elements in 
turn is presented in [10] and this process takes 2^^^^'^^ time. We conclude that the necessary inner 
code can be constructed in n^^^ iog{i/e)) The code Ci, being a folded RS code over a field 

of characteristic 2, is F2-linear, and therefore when concatenated with a binary linear inner code 
such as C2, results in a binary linear code. The rate of the concatenated code is at least R - r. 

The decoding algorithm proceeds in a natural way. Given a received word, we break it up into 
blocks corresponding to the various inner encodings by C\. Each of these blocks is list decoded 
up to a radius />, returning a set of at most I possible candidates for each outer codeword symbol. 
The outer code is then {R + e, Z)-list recovered using these sets, each of which has size at most /, 
as input. To argue about the fraction of errors this algorithm corrects, we note that the algorithm 
fails to recover a codeword only if on more than a fraction {1 — R — e) of the inner blocks the 
codeword differs from the received word on more than a fraction p of symbols. It follows that the 
algorithm correctly list decodes up to a radius (1 — R — e)p = {1 — R — e)H~^{l — r — e). Since 
e > was arbitrary, we get the claimed result. □ 

Optimizing over the choice of inner and outer codes rates r, R in the above results, we can 
decode up to the Zyablov bound, see Figure [21 
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Remark 5.2. In particular, decoding up to the Zyablov bound implies that we can correct a fraction 
(1/2 — e) of errors with rate J^(e^) for small e ^ 0, which is better than the rate of log(l/e)) 
achieved in [13]. However, our construction and decoding complexity are n^^^ i°g{i/^)) whereas 
these are at most f{£)rf for an absolute constant c in [13]. Also, we bound the list size needed in the 
worst-case by rP^^ i°g(i/e)) ^ while the list size needed in the construction in [13] is (1/ ^°g(^/^)) . 

Remark 5.3 (Decoding up to the Blokh-Zyablov bound). In a follow-up paper, we use a similar 
approach extended to multilevel concatenation schemes together with inner codes that have good 
"nested" list-decodability properties, to construct binary codes list-decodable up to the Blokh- 
Zyablov bound |15j . 

5.3 Capacity- Achieving codes over smaller alphabets 

Our result of Theorem 14.41 has two undesirable aspects: both the alphabet size and worst-case list 
size output by the list decoding algorithm are a polynomial of large degree in the block length. We 
now show that the alphabet size can be reduced to a constant that depends only on the distance e 
to capacity. 

Theorem 5.3. For every R, < R < 1, every e > 0, there is a polynomial time constructible 
family of codes over an alphabet of size can be 

list decoded up to a fraction {1 — R — e) of errors in polynomial time. 

Proof. The theorem is proved using the code construction scheme used in [T^ for linear time 
unique decodable codes with optimal rate, with different components appropriate for list decoding 
plugged in. We briefly describe the main ideas behind the construction and proof below. The high 
level approach is to concatenate two codes Cout and Cin, and then redistribute the symbols of the 
resulting codeword using an expander graph (Figure [6] depicts this high level structure and should 
be useful in reading the following formal description). In the following, assume that e < 1/6 and 
let 6 = e^. 

The outer code Cout will be a code of rate (1 — 2e) over an alphabet S of size n^^l^'^'''"'^^ that can 
be (1 — e, 0(l/e))-list recovered in polynomial time, as guaranteed by Theorem 15.11 That is, the 
rate of Cout will be close to 1, and it can be (C, Z)-list recovered for large / and Q ^ 1. 

The inner code Cn will be a ((1 — i? — 4e), 0(l/e))-list decodable code with near-optimal rate, 
say rate at least {R + 3e). Such a code is guaranteed to exist over an alphabet of size 0(l/e^) 
using random coding arguments. A naive brute-force for such a code, however, is too expensive, 
since we need a code with |S| = n^^-*^^ codewords. Guruswami and Indyk [11], see also [HI Sec. 9.3], 
prove that there is a small (quasi-polynomial sized) sample space of pseudolinear codes in which 
most codes have the needed property. Furthermore, they also present a deterministic polynomial 
time construction of such a code (using derandomization techniques), see [HJ Sec. 9.3.3]. 

The concatenation of Cout and Cm gives a code Cconcat of rate at least (1 — 2e){R -\- 2>e) ^ R 
over an alphabet S of size |S| = 0(l/e^). Moreover, given a received word of the concatenated 
code, one can find all codewords that agree with the received word on a fraction R + Ae of locations 
in at least (1 — e) of the inner blocks. Indeed, we can do this by running the natural list decoding 
algorithm, call it A, for Cconcat that decodes each of the inner blocks to a radius of (1 — i? — 4e) 
returning up to I = 0{l/e) possibilities for each block, and then (1 — e, i)-list recovering Cout' 
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The last component in this construction is a D = 0(l/e^)-regular bipartite expander graph 
which is used to redistribute symbols of the concatenated code in a manner so that an overall 
agreement on a fraction i? + 7e of the redistributed symbols implies a fractional agreement of 
at least i? + 4e on most (specifically a fraction (1 — e)) of the inner blocks of the concatenated 
code. In other words, the expander redistributes symbols in a manner that "smoothens" the 
distributions of errors evenly among the various inner blocks (except for possibly a e fraction of 
the blocks). This expander based redistribution incurs no loss in rate, but increases the alphabet 
size to 0(l/e2)0(iA^) = 2«(^"'i°s(Ve)). 




Codeword in 

C concat 



Figure 6: The code C* used in the proof of Theorem 15.31 We start with a codeword {ui, . . . ,U]\fi) 
in Cout- Then every symbol is encoded by Cjn to form a codeword in Cconcat (this intermediate 
codeword is marked by the dotted box). The symbols in the codeword for Cconcat are divided into 
chunks of D symbols and then redistributed along the edges of an expander G of degree D. In the 
figure, we use D = 3 for clarity. Also the distribution of three symbols a, b and c (that form a 
symbol in the final codeword in C*) is shown. 



We now discuss some details of how the expander is used. Suppose that the block length of the 
folded RS code Cout is Ni and that of Cin is N2. Let us assume that N2 is a multiple of D, say 
-^2 = (if this is not the case, we can make it so by padding at most D — 1 dummy symbols at 
a negligible loss in rate). Therefore codewords of Cin, and therefore also of Cconcat, can be thought 
of as being composed of blocks of D symbols each. Let N = Nin2, so that codewords of Cconcat 
can be viewed as elements in (S^)^. 
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Let G = (L, R, E) be a D-regular bipartite graph with vertices on each side (i.e., \L\ = \R\ = 
N), with the property that for every subset y C of size at least {R + 7e)N , the number of vertices 
belonging to L that have at most (i? + Qe)D of their neighbors in Y is at most 6N (for 6 = e^). It 
is a well-known fact (used also in [12]) that if G is picked to be the double cover of a Ramanujan 
expander of degree D ^ 4/(fe^), then G will have such a property. 

We now define our final code C* = G(Cconcat) ^ (S^)^ formally. The codewords in G* are in 
one-one correspondence with those of Cconcat. Given a codeword c G Cconcat, its ND symbols (each 
belonging to S) are placed on the ND edges of G, with the D symbols in its i'th block (belonging 
to E^, as defined above) being placed on the D edges incident on the i'th vertex of L (in some fixed 
order). The codeword in C* corresponding to c has as its i'th symbol the collection of D symbols 
(in some fixed order) on the D edges incident on the i'th vertex of R. See Figure [6] for a pictorial 
view of the construction. 

Note that the rate of G* is identical to that Cconcat; and is thus at least R. Its alphabet size is 
= 0(l/e2)0{i/e^) = 2^(^"''i°g(^/^)), as claimed. We will now argue how G* can be list decoded 
up to a fraction {1 — R — 7e) of errors. 

Given a received word r G (S^)^, the following is the natural algorithm to find all codewords 
of G* with agreement at least {R+ 7e)N with r. Redistribute symbols according to the expander 
backwards to compute the received word r' for Cconcat which would result in r. Then run the 
earlier- mentioned decoding algorithm A on r'. 

We now briefly argue the correctness of this algorithm. Let c E C* be a codeword with 
agreement at least {R + 7e)N with r. Let c' denote the codeword of Cconcat that leads to c after 
symbol redistribution by G, and finally suppose c" is the codeword of Cout that yields c' upon 
concatenation by Cin. By the expansion properties of G, it follows that all but a 6 fraction of 
N D-long blocks of r' have agreement at least (R + ()e)D with the corresponding blocks of c'. 
By an averaging argument, this implies that at least a fraction (1 — \/5) of the A'^i blocks of c' 
that correspond to codewords of Cin encoding the A^i symbols of c", agree with at least a fraction 
(1 — V5){R + 6e) = {1 — e){R + 6e) ^ i? + 4e of the symbols of the corresponding block of r'. As 
argued earlier, this in turn implies that the decoding algorithm A for Cconcat when run on input r' 
will output a polynomial size list that will include c'. □ 

6 Concluding Remarks 

We close with some remarks and open questions. In the preliminary version [M] of this paper, 
we noted that the folded RS codes bear some resemblance to certain "randomness extractors" 
constructed in [26], and wondered if some of the techniques in this work and [25] could be used 
to construct simple extractors based on univariate polynomials. In a recent work [19], this has 
been answered in the affirmative in a fairly strong sense. It is shown in [19] that the Parvaresh- 
Vardy codes yield excellent "randomness condensers," which achieve near-optimal compression of a 
weak random source while preserving all its min-entropy, and in turn these lead to the best known 
randomness extractors (that are optimal up to constant factors). 

We have solved the qualitative problem of achieving list decoding capacity over large alphabets. 
Our work could be improved with some respect to some parameters. The size of the list needed to 
perform list decoding to a radius that is within e of capacity grows as n^^^/^^ where n is the block 
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length of the code. It remains an open question to bring this hst size down to a constant independent 
of n, or even to f{£)rf with an exponent c independent of e (we recall that the existential random 
coding arguments work with a list size of 0(l/e)). We managed to reduce the alphabet size needed 
to approach capacity to a constant independent of n. However, this involved a brute-force search 
for a rather large code. Obtaining a "direct" algebraic construction over a constant-sized alphabet 
(such as variants of algebraic-geometric (AG) codes) might help in addressing these two issues. 
To this end, Guruswami and Patthak [13] define correlated AG codes, and describe list decoding 
algorithms for those codes, based on a generalization of the Parvaresh-Vardy approach to the general 
class of algebraic-geometric codes (of which RS codes are a special case). However, to relate folded 
AG codes to correlated AG codes like we did for RS codes requires bijections on the set of rational 
points of the underlying algebraic curve that have some special, hard to guarantee, property. This 
step seems like an highly intricate algebraic task, and especially so in the interesting asymptotic 
setting of a family of asymptotically good AG codes over a fixed alphabet. 

Finally, constructing binary codes (or g-ary codes for some fixed, small value of q) that approach 
the respective list decoding capacity remains a challenging open problem. In recent work [16], we 
show that there exist g'-ary linear concatenated codes that achieve list decoding capacity (in the 
sense that every Hamming ball of radius H~^{1 — R — e) has polynomially many codewords, where 
R is the rate). In particular, this results holds when the outer code is a folded RS code. This 
is somewhat encouraging news since concatenation has been the preeminent method to construct 
good list-decodable codes over small alphabets. But realizing the full potential of concatenated 
codes and achieving capacity (or even substantially improving upon the Blokh-Zyablov bound) 
with explicit codes and polynomial time decoding remains a huge challenge. It seems likely that 
carefully chosen soft information to pass from the inner decodings to the outer algebraic decoder 
(see j20l [18] for examples of such decoders) may hold the key to further progress in list decoding 
concatenated codes. 
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